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Braiding of Majorana fermions gives accurate topological quantum operations that are intrinsi- 
cally robust to noise and imperfection, providing a natural method to realize fault-tolerant quan- 
tum information processing. Unfortunately, it is known that braiding of Majorana fermions is not 
sufficient for implementation of universal quantum computation. Here we show that topological 
manipulation of Majorana fermions provides the full set of operations required to generate random 
numbers by way of quantum mechanics and to certify its genuine randomness through violation of 
a multipartite Bell inequality. The result opens a new perspective to apply Majorana fermions for 
robust generation of certified random numbers, which has important applications in cryptography 
and other related areas. 



PACS numbers: 03.67.-a, 03.65. Ud, 05.30.Pr,71.10.Pm 

The complex-valued solutions to the Dirac equation 
predict that every elementary particle should have a com- 
plex conjugate counterpart, namely an antiparticle. For 
example, an electron has a positron as its antiparticle. 
However, in 1937 Ettore Majorana [1] showed that the 
complex Dirac equation can be modified to permit real 
wave-functions, leading to the possible existence of the 
so called " Majorana fermions" which are their own an- 
tiparticles [2]. In condensed matter physics, Majorana 
fermions may appear as elementary qusi-particle excita- 
tions. To search for Majorana fermions, several propos- 
als have been made in recent years, including v = 5/2 
fractional quantum Hall system [3, 4], topological insu- 
lator (TI) — superconductor (SC) interface [5], interact- 
ing quantum spins [6] , chiral p-wave superconductors [7] , 
spin-orbit coupled semiconductor thin film [8] or quan- 
tum nanowire [9, 10] in the proximity of an external s- 
wave superconductor. Based on these proposals, exper- 
imentalists have made great progress recently. For in- 
stance, Ref. [11] reported an experimental observation of 
coexistence of the superconducting gap and the topologi- 
cal surface state in the Bi2Se3 thin film as a step towards 
realization of Majorana fermions. More recently, sig- 
nature of Majorana fermions in hybrid superconductor- 
semiconductor nanowire device has been reported [12], 
which has raised strong interest in the community. 

Majorana fermions are exotic particles classified as 
non-abelian anyons with fractional statistics, and braid- 
ing between them gives nontrivial quantum operations 
that are topological in nature. These topological quan- 
tum operations are intrinsically robust to noise and ex- 
perimental imperfection, so they provide a natural so- 
lution to realization of fault-tolerant quantum gates. 
Application of Majorana fermions in implementation 
of fault-tolerant quantum computation has raised great 
interest [4, 6]. Unfortunately, braiding of Majorana 
fermions are not sufficient yet for realization of univer- 
sal quantum computation [4], and we need assistance 



from additional non-topological quantum gates which are 
prone to influence of noise. 

In this Letter, we show that topological manipulation 
of Majorana fermions alone can be used to realize a quan- 
tum random number generator in a fault tolerant fashion 
and to certifies its genuine randomness through viola- 
tion of the Mermin-Ardehali-Belinskii-Klyshko (MABK) 
inequality [13-15]. Random numbers have tremendous 
applications in science and engineering [16-18]. How- 
ever, generation of genuine random numbers is a chal- 
lenging task [19]. Any classical device does not gener- 
ate genuine randomness as it allows a deterministic de- 
scription in principle. Quantum mechanics is intrinsi- 
cally random, and one can explore this feature to gen- 
erate random numbers [20-23]. However, in real exper- 
iments, the intrinsic randomness of quantum mechanics 
is always mixed-up with an apparent randomness due to 
noise or imperfect control of the experiment [19]. The 
latter can be exploited by an adversary opponent and 
leads to security loopholes in various applications of ran- 
domness. Recently, a nice idea has been put forward to 
certify genuine randomness generated by a quantum de- 
vice through test of violation of the Bell-CHSH (Clauser- 
Horn- Shimony-Holt [24]) inequality [19, 25], and the idea 
has been demonstrated in a proof-of-principle experiment 
using remote entangled ions [19]. This implementation is 
not fault-tolerant yet as the remote entanglement is sen- 
sitive to noise and the quantum gates have limited pre- 
cision which can all lead to security loopholes. We show 
here that all the operations for generation and certifica- 
tion of genuine randomness can be realized through topo- 
logical manipulation of Majorana fermions. This imple- 
mentation is inherently fault-tolerant and automatically 
closes security loopholes caused by influence of noise. 

The implementation of certification of a quantum ran- 
dom number generator with Majorana fermions is tricky. 
First of all, one can not use the Bell-CHSH inequality 
anymore as proposed in Ref. [19], since it is impossible 
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to violate this inequality through topological manipula- 
tion of Majorana fermions alone [26]. In fact, to observe 
violations of the CHSH inequality, measurements in the 
non-Clifford bases are required. However, topological op- 
erations on Majorana fermions can only give gates in the 
Clifford group, and thus not able to achieve the mea- 
surements required for the CHSH inequality violation for 
randomness certification. Consequently, we have to con- 
sider certification of randomness based on extension of 
the Bell inequalities in the multi-qubit case. For simplic- 
ity, here we use the MABK inequality for three logical 
qubits [13-15]. We show that first, this inequality can be 
used to certify randomness, and second, the inequality 
can be tested with topological manipulation of Majorana 
fermions alone. For the MABK inequality, we consider 
three qubits, each with two measurement settings. We 
denote the measurement settings for each qubit by the 
binary variables x, y, z, and the corresponding measure- 
ment outcomes by a, 6, c, where x, y, z, a, 6, c = 0, 1. The 
MABK inequality can be rewritten as [13-15] 

L = t(x, y, z)[P(even\xyz) — P(odd\xyz)] < 2, 

(1) 

where S = {(0, 0, 0), (0, 1, 1), (1, 0, 1), (1, 1, 0)} and 
t(x, y, z) is a sign function defined by t(x, y, z) = 
( — l)( x +v+ z )/ 2 - P(even\xyz) (P(even\xyz)) is the prob- 
ability that a + b + c is an even (odd) number when 
settings (x, y, z) are chosen. The inequality (1) is sat- 
isfied by all local hidden variable models. However, in 
quantum mechanics certain measurements performed on 
entangled states can violate this inequality. Experimen- 
tally, we can repeat the experiment k times in succession 
to estimate the violation. For each trial, the measure- 
ment choices (x, y, z) are generated by an independent 
identical probability distribution P(xyz). Denote the in- 
put string asl = (xx,y%, z\; ■ • ■ ; Xk,yk, Zk) and the corre- 
sponding output string as O = (ax, bx, C\; ■ ■ ■ ; au, 6fe, Ck)- 
The estimated violation of the MABK inequality can be 
obtained from the observed data as 

L =l E T p/ x V, z) MBVBa\xyz) - N(odd\xyz)}, 

(x,y,z)eS 

(2) 

where iV(even|a;?/z) (N(odd\xyz)) denotes the number of 
trials that we get an even (odd) outcome a + b + c after 
k times of measurements with the measurement setting 
(x,y,z). 

We need to show that the output string O from the 
measurement outcomes contains genuine randomness by 
proving that it has a nonzero entropy. Let {C m : < m < 
mmax} be a series of violation thresholds with Cq = 2 
and C mmaa . = 4, corresponding respectively to the clas- 
sical and quantum bound. Denote by V(m) the proba- 
bility that the observed violation L lies in the interval 
[£ m ,£ m +i). We can use the min-entropy to quantify 



randomness of the output string O [19, 27, 28]: 

^(OIZ, £,m) p ee -log 2 ^[max2?(0,Z,£|m)], (3) 

where £ represents the knowledge that a possible adver- 
sary has on the state of the device and the maximum 
is taken over all possible values of the output string O. 
The probability distribution T>(0,I, £\m) is defined in 
the Supplemental Material. Based on a similar proce- 
dure as in Ref. [19], we can prove that if T>(m) > 5, the 
min-entropy of the output string conditional on the input 
string and the adversary's information has a lower bound 
(see derivation in the supplement), given by 

Eoo(0\T,8,m)j) > kf{C m - e) - log 2 (1/6) , (4) 

where the parameter e = y/— 2(1 + 4r) 2 (ln e' 2 ) with r = 
mhiP(xyz), the smallest probability of the input pairs, 
and e' is a given parameter that characterizes the close- 
ness between the target distribution V(0,I,£) and the 
real distribution after k successive measurements (see the 
supplement for an explicit definition). The function f(L) 
can be obtained through numerical calculation based on 
semi-definite programming (SDP) [29] and is shown in 
Fig. 1. The minimum-entropy bound kf(C m — e) — log 2 j 
and the net entropy versus the number of trials k are 
plotted in the insets (a) and (b) of Fig. 1. Any ob- 
served quantum violation with L > 2 leads to a positive 
lower bound of the min-entropy, and a positive mini- 
entropy guarantees that genuine random numbers can 
be extracted from the string O of the measurement out- 
comes through the standard protocol of random number 
extractors [30] . As some amount of randomness needs to 
be consumed to prepare the input string according to the 
probability distribution P(xyz), the scheme here actually 
realizes a randomness expansion device [19, 25]. Similar 
to Ref. [19] , we can show that under a biased distribution 
P(xyz) as shown in Fig. 1 we generate a much longer ran- 
dom output string of length 0(k) from a relatively small 
amount of random seeds of length 0(Vk log 2 Vk) when 
k is large. 

We now show how to generate and certify random num- 
bers using Majorana fermions. The key step is to gener- 
ate a three-qubit entangled state and find suitable mea- 
surements that lead to violation of the MABK inequality. 
Majorana fermions are non-Abelian anyons, and their 
braiding gives nontrivial quantum operations. However, 
this set of operations are very restricted. First, all the 
gates generated by topological manipulation of Majorana 
fermions belong to the Clifford group, and it is impossi- 
ble to use such operations alone to violate the CHSH 
inequality [26]. We have to consider instead the multi- 
qubit MABK inequality. Second, it is not obvious that 
one can violate the MABK inequality as well using only 
topological operations. There are two ways to encode a 
qubit using Majorana fermions, using either two quasi- 
particles (Majorana fermions) or four quasiparticles (see 
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FIG. 1: (Color online) Plot of the function f(L) versus vi- 
olation L of the MABK inequality. The function is calcu- 
lated through optimization based on the semi-definite pro- 
gramming with the details shown in the Supplemental Mate- 
rial. The inset (a) shows the lower bound of the min-entropy 
kf{C m — e) — log 2 | versus the number of trials k. Here we 
assume an observed MABK violation lies within the inter- 
val 3.9 = C m < L < Cmax = 4 with probability S. The 
parameters are chosen as 8 — 0.001 and e' = 0.01. The 
bound kf(C m — e) depends on the input probability distri- 
bution P(xyz) through the parameter r = m\n xyz P(xyz). 
The blue-square line represents the bound under a uniform 
distribution (P(xyz) = 1/4 for all (x,y,z) £ S), while the 
red-dotted line shows the bound under a biased probability 
distribution with P(011) = P(101) = P(110) = ak~ 1/2 and 
P(000) = 1 — 3afc~ 1//2 with a = 10. It consumes less ran- 
domness to generate a biased distribution for the input bits, 
so the net amount of randomness, defined as the number of 
output random bits minus that of the input, becomes posi- 
tive when k is large (typically k needs to be of the order 10 ). 
The inset (b) plots the net amount of randomness generated 
after k trails under a biased distribution of the inputs. The 
parameters are the same as those in the inset (a). 



the details in the supplement). In the two-quasiparticle 
encoding scheme, although the braiding gates exhaust 
the entire two-qubit Clifford group, they cannot span the 
whole Clifford group for more than two qubits [31]. Fur- 
thermore, braiding Majorana fermions within each qubit 
cannot change the topological charge of this qubit which 
fixes the measurement basis. Thus, no violation of the 
MABK inequality can be achieved using the topologi- 
cal operations alone in the two-quasiparticle encoding 
scheme. In the four-qusiparticle encoding scheme, it is 
not straightforward either as braidings in this scheme 
only allows certain single-qubit rotations and no entan- 
glement can be obtained due to the no-entanglement rule 
proved already for this encoding scheme [32]. 

Fortunately, we can overcome this difficulty by tak- 
ing advantage of the non- destructive measurement of the 
anyon fusion, which can induce qubit entanglement [33]. 
In a real physical device, the anyon fusion can be read out 
non-destructively through the anyon interferometry [34] . 
In the four-qusiparticle encoding scheme: each qubit is 
encoded by four Majorana fermions, with the total topo- 
logical charge 0. The qubit basis-states are represented 
by |0> = !((.,.)!, (.,.)!)!) and |1) = |((., .)^, (., •) i> ) 1 ). 
Here, each • represents a Majorana fermion; I and ^ rep- 
resent the two possible fusion channels of a pair of Ma- 
jorana fermions, with I standing for the vacuum state 
and ip denoting a normal fermion. As explained in the 
Supplemental Material, a topologically protected two- 
qubit CNOT gate can be implemented using braidings 
together with non-destructive measurements of the anyon 
fusion [33]. To certify randomness through the MABK 
inequality, we need to prepare a three-qubit entangled 
state. For this purpose, we need in total fourteen Ma- 
jorana fermions, where twelve of them are used to en- 
code three qubits and another ancillary pair is required 
for implementation of the effective CNOT gates through 
measurement of the anyon fusion. Initially, the logical 
state is |$)j = |000). We apply first a Hadamard gate 
on the qubit 1, which can be implemented through a se- 
ries of anyon braiding as shown in Fig. 2b, and then two 
effective CNOT gates on the logical qubits 1, 2, and 2, 
3. The final state is the standard three-qubit maximally 
entangled state |*)/ = (|000) + | 111))/ VI After \^} f is 
generated, the three qubits can be separated and we need 
only local braiding and fusion of anyons within each qubit 
to perform the measurements in the appropriate bases to 
generate random numbers and certify them through test 
of the MABK inequality. 

To perform the measurements, we read out each qubit 
according to the input string X through nondestructive 
detection of the anyon fusion. If the input is 0, we first 
braid the Majorana fermions to implement a Hadamard 
gate H on this qubit (as shown in Fig. 2b), and then mea- 
sure the fusion of the first two Majorana fermions within 
each qubit. The measurement outcome is (1) if the fu- 
sion result is I (ip). If the input is 1, we first braid the 
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FIG. 2: (Color online) Illustration of the encoding scheme for 
a logic qubit using Majorana fermions and two single-qubit 
operations that can be implemented through anyon braid- 
ing. Each qubit is encoded by four Majorana fermions. (a)A 
counterclockwise braiding of Majorana fermions 2 and 3 im- 
plements a unitary gate B23 on the corresponding qubit. (b) 
Implementation of the Hadamard gate through composition 
of anyon braiding. In both (a) and (b), time flows from left 
to right and ~ means equal up to an irrelevant overall phase. 

Majorana fermions to implement a B 2 z gate (see Fig. 2a) 
on this qubit before the same readout measurement. For 
instance, with the the input (x,y,z) — (0,1,1), we ap- 
ply a Hadamard gate to the first qubit and B23 gates to 
the second and the third qubits, followed by the nonde- 
structive measurement of fusion of the first two Majorana 
fermions in each qubit. Under the state |^)/, the condi- 
tional probability of the measurement outcomes (a, 6, c) 
under the measurement setting (x, y, z) for these three 
qubits is give by 

P{abc\xyz) = KafocKU^U,)!*)/! 2 , (5) 



where Uo = H and Ui = £?23- With this conditional prob- 
ability, we find the expected value of L defined in Eqs. 
(1,2) is L = 4, achieving the maximum quantum violation 
of the MABK inequality All the steps for measurements 
and state preparation are based on the topologically pro- 
tected operations such as anyon braiding or nondestruc- 
tive detection of the anyon fusion, so the scheme here 
is intrinsically fault-tolerant and we should get the ideal 
value of L = 4 if the Majorana fermions can be manipu- 
lated at will in experiments. Such a large violation per- 
fectly certifies genuine randomness of the measurement 
outcomes. 

In summary, we have shown that genuine number num- 
bers can be generated and certified through topologically 
manipulation of Majorana fermions, a kind of anyonic 
excitations in engineered materials. Such a protocol is 
intrinsically fault-tolerant. Given the rapid experimental 
progress on realization of Majorana fermions in real ma- 
terials [11, 12], this protocol offers a promising prospec- 
tive for application of these topological particles in an 
important direction of cryptography with broad implica- 
tions in science and engineering. 

We thank Y. H. Chan, J. X. Gong, and E. Lichko for 
discussions. This work was supported by the NBRPC 
(973 Program) 2011CBA00300 (2011CBA00302), the 
IARPA MUSIQC program, the ARO and the AFOSR 
MURI program. 



SUPPLEMENTARY INFORMATION: FAULT TOLERANT QUANTUM RANDOM NUMBER 
GENERATOR CERTIFIED BY MAJORANA FERMIONS 

This supplementary information gives more details about realization of fault-tolerant quantum random number 
generator through topological manipulation of Majorana fermions. In Sec. I, we give the detailed proof on how to 
certify genuine randomness through observation of violation of the MABK inequality. In Sec. II, we summarize the 
topological properties of Majorana fermions and show the implementation of the necessary topological quantum gates 
on the logic qubits encoded with these Majorana fermions. 



Randomness certified by observation of violation of the MABK inequality 

In this section, we establish a link between randomness of the measurement outputs of a quantum system and 
violation of the MABK inequality. A link between randomness and violation of the Bcll-CHSH inequality has been 
established in Ref. [19, 35]. Here, we generalize the result from the two-qubit CHSH inequality to the three-qubit 
MABK inequality. Consider a quantum nonlocality test on three qubits. Each qubit has two settings of two-outcome 
measurements, denoted by {x,y,z}, respectively for the three qubits. The measurement outputs {a, 6, c} of this 
quantum system are characterized by the joint probability distribution P = {P(abc\xyz)}. Randomness of the 
outputs {a,b,c} are quantified by the min-entropy, defined as E QO (ABC\XYZ) = — log 2 [max (, c P(abc\xyz)]. With 
an experimental observation of violation L of the MABK inequality, our aim is to find a lower bound on the min- 
entropy 



.Eco {ABC\XY Z) > f(L). 



(6) 
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This is equivalent to solving of the following optimization problem [19]: 

P*(abc\xyz) = max P(abc\xyz) 

subject to L = L (7) 

P(abc\xyz) = Tr(pM" <g) M h y ® M 2 C ) 

where L is defined in Eq.(2) of the main text and (p,M^,My,M^) constitutes a quantum realization of the Bell 
scenario [36]. Thus, the minimal value of E OD (ABC\XY Z) compatible with the MABK violation L and quantum 
theory is given by E ao {ABC\XY Z) = — log 2 [max a f, c P* (abc\xyz)]. Consequently to obtain f(L) we only need to solve 
(7) for all possible input and output triplets (x, y, z) and (a, b, c). This can be effectively done by casting it to a semi- 
definite program (SDP) [29]. An infinite hierarchy of conditions that need to be satisfied by all quantum correlations 
are introduced in Ref. [37-39]. All these conditions can be transformed to a SDP problem and the hierarchy is 
complete in the asymptotic limit, i.e., it guarantees existence of a quantum realization if all the conditions in the 
hierarchy are satisfied. Generally, conditions higher in the hierarchy are more constraining and thus better reflect the 
constraints in (7) and give a tighter lower bound. To obtain a lower bound of the min-entropy for a given MABK 
violation L, we use the matlab toolbox SeDuMi [40] and solve the SDP corresponding to the certificates between 
order 1 and order 2 [37]. The result is plotted in Fig.l in the main text. From the figure, f(L) equals zero at the 
classical point L = 2 and increases monotonously as the MABK violation L increases. For the maximal violation 
L = 4, P* fa 0.5003, corresponding to f(L) ~ 0.9991 bits. 

Equation (4) in the main text can be derived using arguments similar to those in Ref. [19, 28]. The difference is 
that the Bell scenario in Refs. [19] is based on the two-qubit CHSH inequality, which needs to be extended in our 
scheme with the threc-qubit MABK inequality. Suppose we run the experiments k times and denote the input and 
output string as X = (xi, y\, z\\ ■ ■ ■ ; Xk, yk, 2fc) and O = (a%, b\, cj.; • • • ; ate, &fc, Cfc), respectively. As in the main text, 
let {C m : < m < m max } be a series of MABK violation thresholds, and denote V(m) the probability that the 
observed KCBS violation L lies in the interval [C m , C m +i)- Denote by £ the possible classical side information an 
adversary may have. To derive Eq. (4) in the main text, let us first introduce the following theorem: 

Theorem 1. Suppose the experiments are carried out k times and each triplet of inputs (x{,yi,Zi) is generated 
independently with probability P(xyz). Let 5, e' > be two arbitrary parameters and r = min{P(xyz))}, then the 
distribution P(OX£) characterizing k successive use of the devices is e'-close to a distribution V such that, either 
V(m) < 5 or 

iUOlZ, £,m) p > fc/(£ ro -e)+log 2 <5, (8) 

where e = (4 + l/r) v /-21ne'/fc- 

Equation (8) is equivalent to Eq. (4) in the main text. Theorem 1 tells us that the distribution P, which characterizes 
the output O of the device and its correlation with the input X and the adversary's classical side information £ , is 
basically indistinguishable from a distribution T> that will be defined below [28] . If we find that the observed MABK 
violation L lies in [£ m ,£ m+1 ) with a non-negligible probability, i.e., T>(m) > 5, the entropy of the outputs O is 
guaranteed to have a positive lower bound kf(C m — e) — log 2 i, that is, the randomness of the outputs is guaranteed 
to be larger than kf(C m ) up to epsilonic correction. 

Proof. We use a procedure similar to those in Ref. [28] to prove the above theorem. Let us define a function 
Q(L) = 2-H L \ which is concave and monotonically decreasing given by the solution of the optimization problem in 
Eq. (7) (shown in Fig. 1 of the main text). Denote by O n — (aj,6j,Cj; • • • ;a„,6„,c„) (n < k) the string of outputs 
before the [n + l)th round of experiment (similarly, X n denotes the string of inputs). We introduce an indicator 
function x(e) as: x( e ) = 1 if the event e happens and x( e ) = otherwise. Consider the following random variable 

U= T[x,y,z)A{a,b,c) P(xyz) ' ^' 

abc\(x,y,z)£S 

where S and t(x, y, z) are defined in the main text, and A(a, b, c) = 1 if a + b + c is even and A(a, b, c) = —1 if a + b + c 
is odd. It is easy to check that Eq.(9) reduces to the MABK expression (2) in the main text and the expectation value 
of Li conditional on the past W l is equal to L{W l ), i.e., E(L l |VF i ) = L{W l ). We use W = (O^X^S) to denote all 
the events before the ith round of experiment and the possible adversary's classical side information. The estimator 
of the MABK violation can be defined as: L = r Xh=i ^i- With these notations, first we introduce two lemmas for 
proof of the main theorem. 

Lemma 1. For any given parameter e' > 0, let e = (4 + l/r^^m e'/k and S e = {{0,X,£)\\ Y* =1 E(£i|W*) > 
L(0,X) — e}, then we have: 
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(i) for any (0,1,£) £ S e , 

P{0\l£)<g k (L(0,l)-e). (10) 

(ii) 

Pr(S e ) = P(0,l,£)>l-e'. (11) 

(o,i,£)es e 

Proof. According to the Bayes' rule and the fact that the response of a system does not depend on the future inputs 
and outputs, we have: 



P(0\1£) = YlPiaMO 1 - 1 !^) 

i=l 
k 

= Y[P(aib i c i \x i y i ZiW i ) (12) 



From the solution to the optimization problem in Eq. (7), the probability P {aibiCi\xiyiZiW l ) is bounded by a function 
of the MABK violation L(VF): P{a l b i c i \x i y l z l W l ) < Q{L(W 1 )). Thus, we have: 

k 

p(o\xs) < l[g(L(w r )) 

i=l 

< g k {^{L i \w i )) 

< G k (L(0,l)-e). (13) 

Here, to obtain the second inequality, we have used the equality E(L J |M /I ) = L(W i ) and the fact that Q is logarith- 
mically concave and monotonically decreasing. The third inequality is obtained from the definition of S e and the 
fact that Q is decreasing. To get Eq. (11), we can define another random variable M q — Yli=i{Li — ^(Li\W 1 )). 
Then it is easy to verify that (i) \M q \ < 2q/r < oo, (ii) \U - L(W l )\ < \U\ + ^(W*)! < \ + 4, and (iii) 
E(M q+1 \W q ) — M q . Thus, the sequence {M q : q > 1} is a martingale process [41]. Applying the Azuma-Hoeffding 

inequality P(M q > fee) < exp(— 2 fc(i/r+4) 2 ) [41~43], we have 

p{\ilnL\W*)<\j^U-^ <e>, (14) 

\ i = l i=l / 

where e = (4 + l/r)W— 21n e'/k. Equation (14) combined with the definition of S e gives Eq. (11). Lemma 1 is thus 
proved. 

In the above proof, we only considered the case that the random variable sequence O takes values in the output 
space § fc = { — 1, l} fc . As in Ref. [28], we can extend the range of O to include "abort-output" _L, and view O as an 
element of S fc U _L with P(0\X£) — if O = _L. The physical meaning of _L is that when _L is produced by the device, 
then no MABK violation has been obtained and no randomness is certified. 

Lemma 2. There exists a probability distribution T> = {T>(0, !,£)}, which is e'-close to P = {P(0, !,£)}, i.e., 
d(T>,P) = |^ OI£ \P(0,I,£) — T>(0 ,1,£)\ < e' , and satisfies the following condition 

V(0\1,£) <g k (L((D,l)-e), (15) 

for all (0,1,£) such that O ^ _L 

Proof. We show how to construct a probability distribution satisfying the above two conditions. To this end, we 
introduce V(0,1,£) = P(1)P(£)V(0\1,£). V(0\1,£) is defined as: 

P{0\1,£), if (0,1,£) e s e 

V(0\1,£)={ 0, if ±and(0,X,£) £ S e (16) 

1 - E(0,z,£)gS e P(0\1,£) otherwise 
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Then by Lemma 1, it is straightforward to get that the distribution T> satisfies Eq. (15) for all (0,I,£) with O ^ 1. 
The distance between P and T> can be calculated as: 



d(V,P) = l - \P(0,1,S)-V(0,I,£)\ 

o,z,e 

= ^P(I,£)]T|P(0|I,£)-P(0|Z,£)| 

x,s o 

\[ J2 P(0,I,S) + 1- Yl p (°^ £ )} (17) 
: e'. 



2 1 

(o,x,s)<£% (o,i,s)e% 



This proves Lemma 2. 

With Lemma 2, now the proof of Theorem 1 becomes straightforward. Define a subset of the outputs as X m — 
{0\0 7^ _L and C rn < L < £ m+ i} and let T>(0,X,£ \m) denote the distribution of O.I.E conditioned on a particular 
value of m, then we have: 



E^iOfcE ,m) v = -log 2 ^[maxX>(0,Z,£|m)] 



X,£ 



-log 2 Y v ( z > £ |m)[maxX>(0|T, £ , 



X,£ 



-log 2 £ 2>(I, £\m) max P( |Z, *) 



X,£ 



-loft, J2 



Vim) 
x,s v ; 

= kf(C m - e) - log 2 



1 

I)(m)' 



Here we have used the Bayes' rule in the first, second and the fourth equalities and Eq. (15) from Lemma 2 in the 
third inequality; for the last equality, the equation / = — log 2 Q is used. The last equality immediately leads to the 
claim in Theorem 1. This concludes the proof. 

It is worthwhile to clarify that in deriving Eq. (8) we have made the following four assumptions [19, 28]: (i) the 
system can be described by quantum theory; (ii) the inputs at the jth trial (xj,yj,Zj) are chosen randomly and 
their values are revealed to the systems only at step j; (iii) the three qubits are separated and non- interacting during 
each measurement step, (iv) the possible adversary has only classical side information. There are no constraints 
on the states, measurements, or the Hilbert space. Moreover, there is even no requirement that the system behaves 
identically and independently for each trial. In particular, the system could have an internal memory (classical or 
quantum) so that the results of the jth trial depend on the previous j — 1 trials. 

We also note that there is a significant difference between the two-qubit scenario in Ref. [19] and our three-qubit 
scenario here. In the two-qubit case, the randomness can be certified by the no-signalling conditions as well without 
the assumption of quantum mechanics. However, in our three-qubit scenario, the no-signalling conditions are not 
sufficient to certify randomness. Actually, we have numerically checked that even for the maximal possible MABK 
violation L max — 4, P* (abc\xyz) can be equal to the unity for certain (a, b, c) and (x,y,z) if only the no-signalling 
conditions arc imposed, which cannot certify any randomness. A possible reason for this difference is that the MABK 
inequality only contains four out of eight possible correlations. In other words, the input choices S is only a subset of 
{(x, y, z)\x, y, z = 0, 1}. As a result, the no-signalling constraints become less effective. 



Encoding and operation of qubits by topological manipulation of Majorana fermions 



In this section, we discuss in detail how to control the logical qubits encoded with Majorana fermions. The fusion 
rule of Majorana fermions is of the Ising type: r x r ~ I + where r, I, and ip stand for a Majorana fermion, 
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the vacuum state, and a normal fermion, respectively. Generally, there are two encoding schemes. The first scheme 
encodes each logical qubit into a pair of Majorana fermions (two-quasiparticle encoding). When the pair fuse to a 
vacuum state I, we say that the qubit is in state |0); and when they fuse to -0, the state is |1). There is also an 
ancillary pair, which soak up the extra ip if necessary to maintain the constraint that the total topological charge 
must be for the entire system [31, 44]. In this encoding scheme, braiding operations of Majorana fermions exhaust 
the entire two-qubit Clifford group. However, for three or more qubits, not all Clifford gates could be implemented by 
braiding. The embedding of the two-qubit SWAP gate into a n-qubit system cannot be implemented by braiding [31]. 
In the two-quasiparticle encoding scheme, no violation of the MABK inequality can be obtained as we cannot change 
the measurement basis through local braiding of Majorana fermions within each logic qubit. 

As we mentioned in the main text, we use the four-quasiparticle encoding scheme where the qubit basis-states 
are represented by |0) = |((», »)i, (•, and |1) = ]((•, •),/,, (•, •)i/>)i)- Let us first consider braiding operations 

of Majorana fermions within each logic qubit. Consider four Majorana operators ci (i = 1,2,3,4) in one logic 
qubit, which satisfy c\ — Ci, c\ = 1 and the anti-commutation relation {c;,Cj} = 2<5y. The Pauli operators in the 
computational basis can be expressed as [34]: 

a x = -ic 2 c 3 , a y = -icic 3 , a z = ~ic x c 2 - (19) 

Unitary operations can be implemented by counterclockwise exchange of two Majorana fermions j < j': 

B 3y = e ( " r/4)(,c ' c >' ) . (20) 

Specifically, we can write down the three basic braiding operators in the computational basis: 



'1 0\ „ 1 / 1 -i 

3 > i) ' 523 " 71 {-i i 



(21) 



where ~ means that we ignore an unimportant overall phase. Using these basic braiding operators, a single-qubit 

Hadamard gate can be implemented as H = ^ \ } ~ B^B^l^B^Blg. The corresponding braidings are shown 

in Fig. 2 of the main text. Note that the set of operations implemented through composition of B12 and B23 are still 
very limited, however, it is fortunate that B23 and H give all the gates that we need for change of the measurement 
bases in test of the MABK inequality. As shown in the main text, we actually get maximum quantum violation of 
the MABK inequality by randomly choosing either a B23 or an H gate on each logic qubit before measurement of the 
anyon fusion. 

With only braiding operations of Majorana fermions, no entangling gate can be achieved for logic qubits in the 
four-quasiparticle encoding scheme due to the no-entanglement rule proved in Ref. [32]. In order to overcome this 
problem, we need assistance from another kind of topological manipulation: nondestructive measurement of the anyon 
fusion, which can be implemented through the anyon interferometry as proposed in Ref. [34]. Suppose that we have 
eight Majorana modes ci, C2, . . . , c$, where the first (last) four modes encode the control (target) qubit, respectively. 
As shown in Ref. [33, 45], a two-qubit controlled phase flip gate A(cr z ) can be implemented through the following 
identity: 

A(<T Z ) = e _ ( 7r / 4 ) C3C4 e _ ( ?T / 4 ) C; 3 C 6 e ( i7T '/ 4 ) c 4 c 3C5C6 e i7r/4 ^2) 

Note that the first two operations in Eq. (22) can be directly implemented by braiding operations. The key step is 
to implement the operation e ^' r / 4 ) C4C3C5C6 . To this end, we use another ancillary pair of Majorana fermions eg and 
Cio- We measure fusion of the four Majorana modes C4C3CQC9. The outcome is ±1, corresponding to either a vacuum 
state (+1) or a normal fermion (—1) . The corresponding projector is given by IL± = |(1± C4C 3 C6Cg). Then, we 

similarly measure fusion of the Majorana modes (operator) — icsCg, with the project denoted by 11^ = g(l =F *C5Cg) 
corresponding to the measurement outcomes ±1. We have the following relation [33, 45]: 



e (m/4)c 4C3 c5c 6 = 2 ^ u, c n( 2 'n[ 4) , (23) 

)7.C=± 

where U ++ — e^l^ c ' jCu \ Uj = ie^/ 2 ^ c * Cs e^ T / 3 ^ CsCe e^ r ^ i ^ Cscl ° , U l. = i e ( Tr / 2 ) c 4C3 e (7r/2)c5c 6e -(ir/4)c 5 cio^ anc j _ 

e -( 7r / 4 ) c 5Ci ^ AH the gates U v ( can be implemented through one or several braiding operations of Majorana fermions. 
So this identity shows that an effective controlled phase flip gate can be implemented on logic qubits through a 
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combination of anyon braiding and measurement of anyon fusion. Depending on the measurement outcomes (£, rf) 
of C4C3C6C9 and — ic^CQ, one can always apply a suitable correction operator U n< ^ to obtain the desired operation 
e (i7r/4)c 4 c3C5C6 _ with controlled phase flip gates, one can easily realize quantum controlled-NOT (CNOT) gate with 
assistance from the Hadamard operations that can be implemented through the anyon braiding. With CNOT and 
Hadamard gates, we can then prepare the maximally entangled three-qubit state as required for test of quantum 
violation of the MABK inequality. 
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